Vulnerability

Carestream Vue RIS leaks technical details in HTTP 500 error pages

MedDevice Cyber Staff · Oct 4 · 2 min read · Via CISA ICSMA-18-277-01

CISA published advisory ICSMA-18-277-01 on October 4, 2018, covering CVE-2018-17891 in Carestream Vue RIS. The affected product is RIS client builds 11.2 and prior running on Windows 8.1 with IIS 7.5. Dan Regalado of Zingbox reported it.

The flaw is CWE-209, an error message that contains sensitive information. When a client contacts a Carestream server where no Oracle TNS listener is available, it triggers an HTTP 500 error that leaks technical information an attacker could use to plan a more elaborate attack. The CVSS v3 score is 3.7, with high attack complexity and a low confidentiality impact.

Carestream remediated the vulnerability in the current version of the software and provides workarounds for affected past versions through Carestream Support and its eService portal. With those mitigations applied, the advisory calls the issue controlled rather than uncontrolled.

A low score still matters here, because error pages that name the database stack and server internals hand an attacker reconnaissance for free. Production servers should return a generic error and log the detail internally.

Are you a representative of Carestream Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Carestream fixed CVE-2018-17891 in the current Vue RIS version and has workarounds for builds 11.2 and prior on Windows 8.1 with IIS 7.5. Sites on older builds should contact Carestream Support or open an eService request to apply them. Upgrading to the current version removes the issue.

Upgrade to the current Vue RIS version. Carestream remediated the error message leak in the current release.
Apply the workarounds on older builds. Request them through Carestream Support or the eService portal for client builds 11.2 and prior.
Return generic errors in production. Software makers should replace detailed server error pages with a generic message and keep the diagnostics in internal logs.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface

Contributing

Named operating system Patient or study database

Vue RIS

PID-311 PID-23 Web interface Named operating system Patient or study database

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2018-17891 in Carestream Vue RIS?

CVE-2018-17891 (CVSS 3.7) is an information leak in Carestream Vue RIS client builds 11.2 and prior on Windows 8.1 with IIS 7.5: contacting a server with no Oracle TNS listener available triggers an HTTP 500 error that exposes technical information. CISA covered it in ICSMA-18-277-01 on October 4, 2018.

Is there a fix for the Carestream Vue RIS error message vulnerability?

Yes. Carestream remediated CVE-2018-17891 in the current version of Vue RIS and provides workarounds for affected past versions, available through Carestream Support or the eService portal, per CISA advisory ICSMA-18-277-01.

← Back to Vulnerabilities